← Vulnerability feed

Vulnerability record · CVE-2026-109619 · published 21 October 2026

CVE-2026-109619: Php use after free vulnerability

Php · Php

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

9.2 CVSS 4.0 Critical CISA KEV since 26 Oct 2026 EPSS 100% · top 0.1% CWE-416 · Use after freeCWE-755 · CWE-755
9.2CVSS 4.0 base score
100%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
12Affected product versions listed by NVD
19References
5 Nov 2026Last modified by NVD

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Exploitation in the wild

CISA added CVE-2026-109619 to the Known Exploited Vulnerabilities catalog on 26 October 2026 as "PHP Stale Internal Request-State Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 29 October 2026.

Affected products

12 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp MitigationVendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/16 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/17 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/23 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/7 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/14 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/15 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/16 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/19 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/2 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/20 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/23/4 Mailing ListThird Party Advisory
https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-executio Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-166980.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-566435.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-566512.html Third Party Advisory
https://php2shell.delftintellab.com/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 US Government Resource
https://www.wiz.io/blog/php2shell-php-rce Third Party Advisory

Track CVE-2026-109619 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-3400PAN-OS GlobalProtect command injection allows unauthenticated root code executionA command injection caused by arbitrary file creation in the GlobalProtect feature of Palo Alto Networks PAN-OS lets an unauthenticated attacker run …KEVEPSS 100%analysed10.0CVE-2020-2021PAN-OS SAML signature verification bypass allows authentication bypassPAN-OS fails to properly verify SAML signatures when SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is unchec…KEVEPSS 4.4%analysed9.8CVE-2024-4577PHP-CGI on Windows argument injection leads to remote code executionPHP-CGI on Windows can misinterpret characters in the command line passed to Win32 API functions when certain code pages are configured, due to Windo…KEVEPSS 100%analysed9.8CVE-2019-11043PHP-FPM buffer overflow enables remote code executionPHP-FPM in certain configurations writes past allocated buffers into FCGI protocol data space, an out-of-bounds write (CWE-787, CWE-120). It affects …KEVEPSS 100%analysed9.8CVE-2017-15944PAN-OS management interface input validation flaw allows remote code executionPAN-OS versions before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 contain an input validation and memory buffer overflo…KEVEPSS 98%analysed9.8CVE-2012-1823PHP-CGI query string option injection enables remote code executionPHP versions before 5.3.12 and 5.4.x before 5.4.2, when run as a CGI script (php-cgi), mishandle query strings that lack an equals sign, allowing com…KEVEPSS 100%analysed9.3CVE-2026-0300PAN-OS User-ID Authentication Portal buffer overflow allows root code executionA buffer overflow (out-of-bounds write, CWE-787) in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS lets an u…KEVEPSS 42%analysed9.3CVE-2024-0012PAN-OS Management Web Interface Authentication BypassPAN-OS contains a missing authentication flaw (CWE-306) in the management web interface that lets an unauthenticated network attacker obtain PAN-OS a…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-109619), CISA KEV, FIRST EPSS (scores of 2026-10-27). This page is refreshed as NVD updates the record.